A few years ago I setup a cron job to automatically ping a URL every minute as part of a monitoring system (that's oversimplification, but it'll do for this question). Because I'm a horrible person, I didn't document this anywhere.

Today, years later, I started having trouble with the application on the other end of the URL that's being pinged. I fixed it, but then realized, I have no idea where this cron job is coming from.

Is there a way to quickly search through or cat out all the crontabs on a particular system? I have root access so permissions aren't a problem. I've only ever been a user of cron, I've never looked too deeply at its implementation, but my *nix instincts say there has to be a group of text files somewhere that hold all the crontabs. I just don't know where they'd be, and if I dug into it I'd be afraid of finding some, but not all of them, or missing some weird nuance of the system

Also, I realize with root access I could

Get a list of all the users in the system

su as a user

crontab -l

Repeat with all the users

but I'm looking for something a little less manual (and looking to learn something about cron's implementation)

Crontabs live in /etc/crontab and (with many implementations) its components in /etc/cron.*/* (all edited by root), and in /var/spool/cron/* (users' crontabs).

If you have trouble locating the offending job, another approach is to investigate one while it's going on. For example, you can add a firewall rule to log the user id of the process opening connections to example.com on port 80:

Approaching it the other way ’round: cron keeps a log of what it is doing, precisely to avoid this kind of problems in the first place. On my system, the log is kept in /var/cron/log and looks like this:

This line tells me that the cron instance with PID 20232 on machine fortress is executing /home/vucar/lighttpd-watchdog on behalf of user vucar. A well-behaved system only has a single cron running, so this will be straightforward.

This also works for at jobs, as they’re usually just handed to cron anyway: